Frontend File Manager < 22.7 - Editor+ Arbitrary File Download

2023-11-1300:00:00

Dmitrii Ignatyev

frontend file manager

arbitrary file download

wordpress plugin

shortcode

file upload

exploit

9.7 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.4%

JSON

Description The plugin has a vulnerability that allows an Editor+ user to bypass the file download logic and download files such as wp-config.php

1) Create new post with this shortcode - [ffmwp]
2) Go to new post and upload any file
3) After that go to main page of plugin for users http://your_site/wordpress/wp-admin/edit.php?post_type=wpfm-files
4) Click to "Edit" button
5) Change wpfm_dir_path and wpfm_file_url to /var/www/html/wordpress/wp-config.php
6) Go back to the main page http://your_site/wordpress/wp-admin/edit.php?post_type=wpfm-files and click "Download"